How did attackers get into Colonial Pipeline?

Through a virtual private network account that was no longer in active use but had not been disabled. Mandiant's investigation, described in congressional testimony, found the password for that account in a batch of leaked credentials associated with a different site, indicating password reuse. The account was not protected by multi-factor authentication, so the password alone granted remote access to the network.

Was the pipeline itself hacked?

The ransomware affected the company's information technology systems rather than the operational technology that runs the pipeline. Colonial shut the pipeline down as a precaution: it could not immediately confirm the operational side was unaffected, and its billing and scheduling systems, which are needed to run the business, were down. The shutdown was a decision made under uncertainty rather than a direct consequence of the malware.

Did Colonial pay the ransom?

Yes, 75 bitcoin, worth about 4.4 million dollars at the time, paid shortly after the attack. The Department of Justice announced in June 2021 that it had recovered approximately 63.7 bitcoin of that payment. The company's chief executive testified that the decision was made because of uncertainty about how long restoration would take and the consequences of a prolonged fuel supply interruption.

Did paying restore the systems?

Not usefully. Reporting and testimony indicate the decryption tool supplied by the attackers was slow enough that the company relied on its own backups for much of the restoration. This is a common outcome: decryptors provided by ransomware operators are frequently slow, buggy, or incomplete, so payment rarely delivers the fast recovery it promises.

Why did petrol stations run dry if the pipeline restarted in days?

Mostly because of panic buying. The pipeline was shut for around five days and demand spiked far above normal as drivers filled every container they had. The shortages were a consumer behaviour effect amplified by news coverage, which is worth noting because the second-order public impact of an IT incident can exceed the direct one.

What changed in regulation afterwards?

The US Transportation Security Administration issued security directives for pipeline owners and operators within weeks, requiring incident reporting to CISA, designating a cybersecurity coordinator, and later mandating specific mitigation measures and testing. Pipeline cybersecurity moved from voluntary guidance to enforceable directive as a direct result.

Colonial Pipeline: One Legacy VPN Account Without MFA

The largest refined fuel pipeline in the United States stopped for five days because of a password.

Not a sophisticated exploit chain, not a zero-day, not a supply chain compromise. A VPN account that nobody used any more, whose password had appeared in a leak from some other website, with no second factor in front of it.

What makes the case instructive is less the intrusion than everything after it: the decision to shut the pipeline under uncertainty, the payment that did not deliver fast recovery, and how quickly an IT incident at a private company became a national fuel story.

Timeline

Date	Event
6 May 2021	Attackers access the network. Data is exfiltrated
7 May 2021	Ransomware is deployed on IT systems. Colonial shuts the pipeline as a precaution and pays 75 bitcoin
8 to 11 May 2021	Panic buying spreads across the southeastern US. Fuel stations run dry
12 May 2021	The pipeline restarts. Normal delivery takes several more days
7 June 2021	The Department of Justice announces recovery of approximately 63.7 bitcoin
Late May and July 2021	TSA issues security directives for pipeline operators

The way in

The account was a legacy VPN profile: still valid, no longer in use, and not protected by multi-factor authentication. Mandiant's investigation found the password in leaked credentials associated with another site, which points to reuse rather than to any compromise of Colonial itself.

Three ordinary failures, stacked:

A dormant account that still worked. Nobody used it, which also means nobody would have noticed it being used. Accounts that survive their purpose are the most attractive credentials in any estate: full access, zero attention. The control is joiner-mover-leaver process and a periodic review that disables anything not authenticated in ninety days.

Password reuse. The same password somewhere else, breached there, sold in bulk, and tried here. What Is an Infostealer covers the modern version of this supply chain, and Password Managers Guide covers the individual fix.

No multi-factor authentication on remote access. One control, applied to that one account, ends this incident before it starts.

There is no fourth failure required. That is the entire initial access story for an incident that made international news.

The shutdown decision

The ransomware ran on business systems. The pipeline's operational technology, the industrial control systems that actually move fuel, was not reported as encrypted.

Colonial stopped the pipeline anyway, for two reasons that are worth separating.

Uncertainty about the boundary. With attackers on the IT network and no way to immediately prove the OT network was untouched, continuing to operate meant betting on a separation the company could not yet verify. Stopping was the conservative choice under incomplete information, and it was the right one.

The business could not function. Billing, scheduling and allocation systems ran on the affected IT side. Fuel can move without invoices for a while, and not indefinitely.

The uncomfortable question this raises for anyone with an OT environment is whether you could answer, on the day, how well separated the two are. Most organisations cannot, because the separation is documented rather than tested, and there are usually more crossings than the diagram shows: a historian server pulling process data into a business database, an engineering workstation with dual connections, a vendor remote-support path, a shared directory for authentication. Network Segmentation Guide covers verifying a boundary rather than declaring one.

The payment

Colonial paid 75 bitcoin, roughly 4.4 million dollars, quickly.

The chief executive's public explanation was uncertainty: it was not clear how long restoration would take, and the consequences of a long fuel supply interruption were severe enough to justify buying an option on faster recovery.

The option did not pay out well. Reporting and testimony indicate the supplied decryption tool was slow enough that the company relied heavily on its own backups. This is the common experience, and it belongs in any pre-incident discussion about payment: decryptors are written by criminals to a standard that does not include performance, they frequently fail on some file types, and restoring from your own tested backups is usually faster. 3-2-1 Backup Strategy covers making sure that option exists.

The recovery of about 63.7 bitcoin by the Department of Justice was a genuine surprise and should not be treated as a repeatable outcome. It depended on specifics of how the funds were held, and most payments are not recovered.

The public consequences

The pipeline was down for about five days. Fuel shortages across the southeastern United States were driven mostly by panic buying: coverage of a pipeline shutdown produced demand far above normal, stations ran dry, and images of empty pumps drove more of the same.

That dynamic deserves a place in incident planning. The second-order public reaction can exceed the direct operational impact, and it is influenced by communication. Organisations running services the public depends on need a communications plan that assumes the story will move faster than the facts.

Regulation followed almost immediately. The TSA issued security directives for pipeline owners and operators requiring reporting of incidents to CISA, a named cybersecurity coordinator, and subsequently specific mitigation measures and testing. A sector that had operated under voluntary guidance was under enforceable direction within weeks, which is the pattern after any incident with visible public consequences.

What generalises

Disable accounts when they stop being needed. Dormant, valid credentials are the cleanest way into any network.
MFA on every remote access path, without exception for legacy profiles. The exceptions are the attack surface.
Know whether your IT and OT separation is real, because you will be asked during an incident and the answer determines whether you can keep operating.
Payment is not a recovery plan. Decryptors are slow and unreliable, and the decision is better made in advance with legal and executive input than at 3am.
Plan the public communications for an incident that affects people outside your organisation.

The verdict

A single unused VPN account with a reused password and no second factor stopped a pipeline that carries a large share of the fuel for the eastern United States.

The technical lesson is small enough to act on today: find the accounts nobody uses, disable them, and put multi-factor authentication on everything that grants remote access. The organisational lesson is larger, and it is that the decisions which determined the impact were made under uncertainty about network boundaries that nobody had verified in advance.